doc: add usage of flowbits OR op

Ticket 5130

(cherry picked from commit 015c9fe1e3aebd2a2f01b91d4e5f81d977bbdd9d)

diff --git a/doc/userguide/rules/flow-keywords.rst b/doc/userguide/rules/flow-keywords.rst
index 73df8341f4ab3473a02dbeae3056e21f05d32d30..f0cad2d3a48acf47f7726a28e33d9956f58dc6a0 100644 (file)
--- a/doc/userguide/rules/flow-keywords.rst
+++ b/doc/userguide/rules/flow-keywords.rst
@@ -53,6 +53,13 @@ will be generated.
 It is possible to use flowbits several times in a rule and combine the
 different functions.
 
+It is also possible to perform an `OR` operation with flowbits with `|` op.
+
+Example::
+  alert http any any -> any any (msg: "User1 or User2 logged in"; content:"login"; flowbits:isset,user1|user2; sid:1;)
+
+This can be used with either `isset` or `isnotset` action.
+
 flow
 ----